Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20230915-en
General
-
Target
setup.exe
-
Size
880KB
-
MD5
43d3ff349ad31e0ad76201755445cb1e
-
SHA1
7b3b15c369203cf892fb0b023201c5627e23973a
-
SHA256
5c402fd8244e177338a2a8f0c7b8df055d5a06ebd7a5225edb3d3cdaf1d1c749
-
SHA512
771f98fcade1687c3714e6631d800ba8f186cc6de46ee36e52e78d04727f0bc7f9352d5f32788a315bd1dc5b84fabd585ea50c1bf32bbd7fc168b87a8a97d101
-
SSDEEP
24576:L20Bj512nz5ME9t+Fez6ovAJv9aGk3KgY7rmvZf5/I:L2Xzh/fvAJ4GkJECvTI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 5016 setup.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1456 wrote to memory of 5016 1456 setup.exe 86 PID 1456 wrote to memory of 5016 1456 setup.exe 86 PID 1456 wrote to memory of 5016 1456 setup.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\is-SO76K.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-SO76K.tmp\setup.tmp" /SL5="$60212,660927,54272,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
PID:5016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
MD5e60a74a65005e4c4f61cbe9c09d368df
SHA11d649b2ab5e08632d64e23f5f9e5675b68e184b4
SHA25678f6692d50d07bd78a97294d196f9ae7d1fc48b058375e5d7bb766970faab758
SHA512a73b84739f4da0827976cf473e63ba3dc7649ab2d37be13c8fb786487d0dc7ef5b2bd446d8c745d75266447357bde4f32f58f1f1c92b156f06f141fea2873856
-
Filesize
680KB
MD5e60a74a65005e4c4f61cbe9c09d368df
SHA11d649b2ab5e08632d64e23f5f9e5675b68e184b4
SHA25678f6692d50d07bd78a97294d196f9ae7d1fc48b058375e5d7bb766970faab758
SHA512a73b84739f4da0827976cf473e63ba3dc7649ab2d37be13c8fb786487d0dc7ef5b2bd446d8c745d75266447357bde4f32f58f1f1c92b156f06f141fea2873856